Enterprise Risk Management: Theory and Practice

1 Tby Brian W. Nocco, Nationwide Insurance, and Ren M. Stulz, Ohio State University*he past two decades have seen a dramatic change in the role of risk management in corporations. Twenty years ago, the job of the corporate risk manager typically, a low-level position in the corporate treasury involved mainly the purchase of insur-ance. At the same time, treasurers were responsible for the hedging of interest rate and foreign exchange exposures. Over the last ten years, however, corporate risk management has expanded well beyond insurance and the hedging of financial exposures to include a variety of other kinds of risk notably operational risk, reputational risk, and, most recently, stra-tegic risk.

2 What s more, at a large and growing number of companies, the risk management function is directed by a senior executive with the title of chief risk officer (CRO) and overseen by a board of directors charged with monitoring risk measures and setting limits for these corporation can manage risks in one of two funda-mentally different ways: (1) one risk at a time, on a largely compartmentalized and decentralized basis; or (2) all risks viewed together within a coordinated and strategic framework. The latter approach is often called Enterprise risk manage - ment , or ERM for short. In this article, we suggest that companies that succeed in creating an effective ERM have a long-run competitive advantage over those that manage and monitor risks individually.

3 Our argument in brief is that, by measuring and managing its risks consistently and systemati-cally, and by giving its business managers the information and incentives to optimize the tradeoff between risk and return, a company strengthens its ability to carry out its strategic plan . In the pages that follow, we start by explaining how ERM can give companies a competitive advantage and add value for shareholders. Next we describe the process and challenges involved in implementing ERM. We begin by discussing how a company should assess its risk appetite, an assess- ment that should guide management s decision about how much and which risks to retain and which to lay off. Then we show how companies should measure their risks .

4 Third, we discuss various means of laying off non-core risks , which, as we argue below, increases the firm s capacity for bearing those core risks the firm chooses to retain. Though ERM is conceptually straightforward, its implementation is not. And in the last and longest section of the chapter, we provide an extensive guide to the major difficulties that arise in Practice when implementing ERM. How Does ERM Create Shareholder Value?ERM creates value through its effects on companies at both a macro or company-wide level and a micro or busi-ness-unit level. At the macro level, ERM creates value by enabling senior management to quantify and manage the risk-return tradeoff that faces the entire firm.

5 By adopting this perspective, ERM helps the firm maintain access to the capital markets and other resources necessary to implement its strategy and business the micro level, ERM becomes a way of life for manag-ers and employees at all levels of the company. Though the academic literature has concentrated mainly on the macro-level benefits of ERM, the micro-level benefits are extremely important in Practice . As we argue below, a well-designed ERM system ensures that all material risks are owned, and risk-return tradeoffs carefully evaluated, by operating managers and employees throughout the firm. The Macro Benefits of Risk ManagementStudents in the first finance course of an MBA program often come away with the perfect markets view that since shareholders can diversify their own portfolios, the value of a firm does not depend on its total risk.

6 In this view, a company s cost of capital, which is a critical determinant of its P/E ratio, depends mainly on the systematic or non-diversifiable component of that risk (as typically measured by a company s beta ). And this in turn implies that efforts to manage total risk are a waste of corporate in the real world, where investors information is far from complete and financial troubles can disrupt a company s operations, a bad outcome resulting from a diversifiable risk say, an unexpected spike in a currency or commodity price can have costs that go well beyond the immediate hit to cash flow and earnings. In the language of economists, such risks can have large deadweight of Applied Corporate Finance Volume 18 Number 4 A Morgan Stanley Publication Fall 2006 Enterprise Risk management : Theory and Practice * We are grateful for comments from Don Chew, Michael Hofmann, Joanne Lamm-Tennant, Tom O Brien, J r me Taillard, and William Wilt.

7 1. There is a large academic literature that investigates how firm value depends on total risk. For a review of that literature, see Ren Stulz, Risk management and Deriva-tives, Southwestern Publishing, illustrate, if a company expects operating cash flow of $200 million for the year and instead reports a loss of $50 million, a cash shortfall of this size can be far more costly to the firm than just the missing $250 million. First of all, to the extent it affects the market s expectation of future cash flows and earnings, such a shortfall will generally be associ-ated with a reduction in firm value of much more than $250 million a reduction that reflects the market s expectation of lower growth.

8 And even if operating cash flow rebounds quickly, there could be other, longer-lasting effects. For example, assume the company has a number of strategic investment opportunities that require immediate funding. Unless the firm has considerable excess cash or unused debt capacity, it may be faced with the tough choice of cutting back on planned investments or raising equity in difficult circumstances and on expensive terms. If the cost of issuing equity is high enough, management may have little choice but to cut investment. And unlike the adjustment of market expectations in response to what proves to be a temporary cash shortfall, the loss in value from the firm having to pass up positive-NPV projects represents a permanent reduction in value.

9 For most companies, guarding against this corpo-rate underinvestment problem is likely to be the most important reason to manage risk. By hedging or otherwise managing risk, a firm can limit (to an agreed-upon level) the probability that a large cash shortfall will lead to value-destroying cutbacks in investment. And it is in this sense that the main function of corporate risk management can be seen as protecting a company s ability to carry out its business which risks should a company lay off and which should it retain? Corporate exposures to changes in curren-cies, interest rates, and commodity prices can often be hedged fairly inexpensively using derivatives such as forwards, futures, swaps, and options.

10 For instance, a foreign exchange hedging program using forward contracts typically has very low transaction costs; and when the trans-fer of risk is inexpensive, there is a strong case for laying off economic risks that could otherwise undermine a compa-ny s ability to execute its strategic plan . On the other hand, companies in the course of their normal activities take many strategic or business risks that they cannot profitably lay off in capital markets or other developed risk transfer markets. For instance, a company with a promising plan to expand its business typically cannot find an economic hedge if indeed there is any hedge at all for the business risks associated with pursu-ing such growth.